SPLK-2002(205Q) Question #185: Real Exam Question with Answer & Explanation

Question

Options

• AReplication of knowledge objects.
• BDeployment of baseline app configurations.
• CDistribute non-replicated, non-runtime configuration updates.
• DMigration of app and user configurations into the search head cluster.

Explanation

Per the Search Head Clustering (SHC) Deployer Administration Guide, the deployer is responsible for distributing configuration bundles, apps, and baseline settings to all members of a Search Head Cluster (SHC). However, the replication of knowledge objects (Option A) is not handled by the Knowledge object replication-covering items such as saved searches, dashboards, lookups, and alerts-is managed internally within the Search Head Cluster using the captain node. The captain coordinates replication among all SHC members using a mechanism called Knowledge Object Replication Framework, which ensures that user-created or runtime configuration changes (e.g., dashboards saved in Splunk Web) are automatically shared across members. In contrast, the deployer's primary responsibilities include: Deploying and updating baseline app configurations (Option B). Distributing non-replicated, non-runtime configuration updates like props, transforms, and inputs Assisting in the initial migration of apps and configurations into a cluster during setup (Option D). Therefore, while the deployer handles static configuration management, knowledge object replication is performed dynamically by the SHC itself under captain control, making Option A the - Search Head Clustering: How the Deployer Works - Managing Knowledge Object Replication in Search Head Clusters - Splunk Enterprise Admin Manual - Deployer vs. Captain Responsibilities - Distributing Apps and Configurations with the Deployer

No community discussion yet for this question.